The GDPR (General Data Protection Regulation), in force since May 25, 2018, governs how a hotel collects, uses and stores guest data. A hotel can keep a rich guest database, provided each use has a legal basis and a clear purpose, guests are informed, marketing relies on valid consent, data is kept only as long as needed and is properly secured. In 2026, these rules also apply to cookie consent for advertising and to AI tools that process guest data.
Key takeaways
- Each processing needs a legal basis: the booking contract, a legal obligation, legitimate interest or consent.
- Marketing emails to guests and prospects generally require consent, with an easy way to unsubscribe.
- Fines can reach €20 million or 4% of annual worldwide turnover, whichever is higher.
Which guest data can a hotel collect?
The data needed for the stay: identity, contact details, dates, payment, preferences shared by the guest and, in many countries, the police registration form for foreign guests. Collect only what serves a stated purpose, and avoid sensitive data (health, religion) unless the guest volunteers it for a specific service, such as a dietary requirement.
.png)
What are the main GDPR obligations for a hotel?
- Inform: a clear privacy policy on the website and at booking.
- Consent for marketing: a box that is not pre-ticked to receive newsletters, separate from the booking terms.
- Retention: define how long each type of data is kept, then delete or anonymize it.
- Guest rights: access, correction, deletion, objection and portability, answered within one month.
- Security: limited access, strong passwords, secure tools, and notification of data breaches within 72 hours.
- Providers: data processing agreements with the PMS, booking engine, CRM and agencies.
What changes with cookies, Consent Mode and the AI Act?
Advertising tags (Google, Meta) can only fire after the visitor accepts cookies. Since March 2024, Google requires Consent Mode v2 for advertisers using its audience features with European traffic. The EU AI Act adds its own rules: since August 2, 2026, chatbots must tell users they are talking to an AI, and any AI tool fed with guest data must also comply with the GDPR.
How does Influence Society handle guest data for hotels?
At Influence Society, we set up consent banners, Consent Mode and server-side tracking on hotel websites, build newsletter sign-ups with explicit consent, and work with the hotel's CRM and PMS providers so that data flows stay documented and compliant. See also our article on hotel databases.
Sources: Regulation (EU) 2016/679 (GDPR); CNIL, guidance on hotels and marketing (accessed November 2026).
FAQ
Can a hotel send newsletters to past guests without consent?
In some countries, a soft opt-in allows emails about similar services to existing customers, if they were informed and could refuse at collection. In practice, explicit consent is the safest approach.
How long can a hotel keep guest data?
Only as long as needed for the purpose. Booking and accounting data follow legal retention periods; prospect data for marketing is commonly kept up to three years after the last contact.
Does the AI Act apply to hotels?
Yes, when a hotel uses AI systems. Since August 2, 2026, a hotel chatbot must inform users that they are interacting with an AI, and AI tools must also respect the GDPR.